Phase 1 of retrospective fixes addressing 6 critical issues that slow down our workflow.
Changes
1. Auto-merge trigger fix (CRITICAL)
Problem: Gitea's labeled event payload may not populate pull_request.labels correctly, causing the YAML condition contains(github.event.pull_request.labels.*.name, 'ready-to-merge') to never evaluate to true.
Fix: Use github.event.label.name == 'ready-to-merge' condition instead, which is more reliable. The Python script still verifies via API as a fallback.
Files:auto-merge.yml
2. Vikunja race condition fix (CRITICAL)
Problem: The vikunja and release jobs run in parallel. The release job pushes a new commit to master before the vikunja job reads HEAD, causing it to read the release commit instead of the merge commit. The release commit has no GRM-N identifier, so the Vikunja task is never marked as done.
Fix: Add --git-sha option to post_merge.py so the workflow can pass ${{ github.sha }} (the commit that triggered the workflow) instead of --from-git (which reads HEAD at runtime).
Files:post_merge.py, post-merge.yml
3. CI wait timeout increase (MEDIUM)
Problem: 180s (3 min) timeout was too short for CI pipelines that include molecule tests.
Fix: Increase to 600s (10 min).
Files:auto_merge.py
4. Doc coverage enforcement (CRITICAL)
Problem:doc_coverage.py was called without --fail-on-missing, so missing documentation never blocked CI.
Fix: Add --fail-on-missing flag.
Files:ci.yml
5. Dependency security scanning (CRITICAL)
Problem: Only code-level security scanning (bandit) was performed. No dependency vulnerability scanning.
Fix: Add pip-audit to CI quality job and dev dependencies. Add lint-deps Makefile target.
Files:ci.yml, pyproject.toml, Makefile
6. api_clients.py classification verified
Confirmed that api_clients.py is NOT imported by anything in src/gitea_runner_manager/ — only by CI scripts. Classification as workflow-only is correct.
Test Coverage
All 841 tests pass with 100% coverage. New tests added for --git-sha option.
Closes GRM-54
## Summary
Phase 1 of retrospective fixes addressing 6 critical issues that slow down our workflow.
## Changes
### 1. Auto-merge trigger fix (CRITICAL)
- **Problem:** Gitea's `labeled` event payload may not populate `pull_request.labels` correctly, causing the YAML condition `contains(github.event.pull_request.labels.*.name, 'ready-to-merge')` to never evaluate to true.
- **Fix:** Use `github.event.label.name == 'ready-to-merge'` condition instead, which is more reliable. The Python script still verifies via API as a fallback.
- **Files:** `auto-merge.yml`
### 2. Vikunja race condition fix (CRITICAL)
- **Problem:** The `vikunja` and `release` jobs run in parallel. The release job pushes a new commit to master before the vikunja job reads HEAD, causing it to read the release commit instead of the merge commit. The release commit has no GRM-N identifier, so the Vikunja task is never marked as done.
- **Fix:** Add `--git-sha` option to `post_merge.py` so the workflow can pass `${{ github.sha }}` (the commit that triggered the workflow) instead of `--from-git` (which reads HEAD at runtime).
- **Files:** `post_merge.py`, `post-merge.yml`
### 3. CI wait timeout increase (MEDIUM)
- **Problem:** 180s (3 min) timeout was too short for CI pipelines that include molecule tests.
- **Fix:** Increase to 600s (10 min).
- **Files:** `auto_merge.py`
### 4. Doc coverage enforcement (CRITICAL)
- **Problem:** `doc_coverage.py` was called without `--fail-on-missing`, so missing documentation never blocked CI.
- **Fix:** Add `--fail-on-missing` flag.
- **Files:** `ci.yml`
### 5. Dependency security scanning (CRITICAL)
- **Problem:** Only code-level security scanning (bandit) was performed. No dependency vulnerability scanning.
- **Fix:** Add `pip-audit` to CI quality job and dev dependencies. Add `lint-deps` Makefile target.
- **Files:** `ci.yml`, `pyproject.toml`, `Makefile`
### 6. api_clients.py classification verified
- Confirmed that `api_clients.py` is NOT imported by anything in `src/gitea_runner_manager/` — only by CI scripts. Classification as workflow-only is correct.
## Test Coverage
All 841 tests pass with 100% coverage. New tests added for `--git-sha` option.
Closes GRM-54
## Automated PR Review
- Architecture compliance: OK
- Best practices: OK
- Security: OK
- Documentation: OK
- Tests: OK
- Commit conventions: OK
No issues found by automated checks.
---
**Manual review required:** Before approving, review every category in
[REVIEW_CHECKLIST.md](REVIEW_CHECKLIST.md) and confirm with:
```bash
python3 scripts/ci/review_pr.py <PR> <owner/repo> \
--event APPROVE --checklist-confirmed \
--body "<substantive review summary>"
```
## Automated PR Review
- Architecture compliance: OK
- Best practices: OK
- Security: OK
- Documentation: OK
- Tests: OK
- Commit conventions: OK
No issues found by automated checks.
---
**Manual review required:** Before approving, review every category in
[REVIEW_CHECKLIST.md](REVIEW_CHECKLIST.md) and confirm with:
```bash
python3 scripts/ci/review_pr.py <PR> <owner/repo> \
--event APPROVE --checklist-confirmed \
--body "<substantive review summary>"
```
emil
merged commit d9161821ea into master2026-06-22 08:04:54 +00:00
emil
deleted branch GRM-54-fix-broken-automation2026-06-22 08:04:55 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
emil
Summary
Phase 1 of retrospective fixes addressing 6 critical issues that slow down our workflow.
Changes
1. Auto-merge trigger fix (CRITICAL)
labeledevent payload may not populatepull_request.labelscorrectly, causing the YAML conditioncontains(github.event.pull_request.labels.*.name, 'ready-to-merge')to never evaluate to true.github.event.label.name == 'ready-to-merge'condition instead, which is more reliable. The Python script still verifies via API as a fallback.auto-merge.yml2. Vikunja race condition fix (CRITICAL)
vikunjaandreleasejobs run in parallel. The release job pushes a new commit to master before the vikunja job reads HEAD, causing it to read the release commit instead of the merge commit. The release commit has no GRM-N identifier, so the Vikunja task is never marked as done.--git-shaoption topost_merge.pyso the workflow can pass${{ github.sha }}(the commit that triggered the workflow) instead of--from-git(which reads HEAD at runtime).post_merge.py,post-merge.yml3. CI wait timeout increase (MEDIUM)
auto_merge.py4. Doc coverage enforcement (CRITICAL)
doc_coverage.pywas called without--fail-on-missing, so missing documentation never blocked CI.--fail-on-missingflag.ci.yml5. Dependency security scanning (CRITICAL)
pip-auditto CI quality job and dev dependencies. Addlint-depsMakefile target.ci.yml,pyproject.toml,Makefile6. api_clients.py classification verified
api_clients.pyis NOT imported by anything insrc/gitea_runner_manager/— only by CI scripts. Classification as workflow-only is correct.Test Coverage
All 841 tests pass with 100% coverage. New tests added for
--git-shaoption.Closes GRM-54
Automated PR Review
No issues found by automated checks.
Manual review required: Before approving, review every category in
REVIEW_CHECKLIST.md and confirm with:
Automated PR Review
No issues found by automated checks.
Manual review required: Before approving, review every category in
REVIEW_CHECKLIST.md and confirm with: